# ExternalSecret - OpenViking Credentials
# Wong, Phase 1, t_32766900
#
# Syncs OpenViking credentials from 1Password mk-labs vault
# Pattern: Harbor proven pattern (cluster/platform/harbor/externalsecret.yaml)
# Store: onepassword-connect ClusterSecretStore
# Namespace: openviking (created by Peter Parker in Phase 2)
# Wave: 8 (after Harbor Wave 7)

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: openviking-credentials
  namespace: openviking
  annotations:
    # Wave -1: Ensure ExternalSecret syncs BEFORE the Deployment (wave 0)
    # This guarantees the secret exists before the pod tries to mount it
    argocd.argoproj.io/sync-wave: "-1"
    description: "Phase 1 secrets for OpenViking deployment"
spec:
  refreshInterval: "1h"
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  target:
    name: openviking-credentials
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        root_api_key: "{{ .OPENVIKING_ROOT_API_KEY }}"
        embedding_api_key: "{{ .OPENVIKING_EMBEDDING_API_KEY }}"
        vlm_api_key: "{{ .OPENVIKING_VLM_API_KEY }}"

  data:
    # OpenViking root API key - server administration
    # Source: 1Password item "openviking", field "root-api-key"
    - secretKey: OPENVIKING_ROOT_API_KEY
      remoteRef:
        key: openviking
        property: root-api-key

    # Embedding model endpoint token (nomic-embed-text-v1.5 at astro-orbiter:8002)
    # Source: 1Password item "openviking", field "embedding-api-key"
    # Phase 0 recommendation: placeholder token for local endpoint
    - secretKey: OPENVIKING_EMBEDDING_API_KEY
      remoteRef:
        key: openviking
        property: embedding-api-key

    # VLM endpoint token (Llama-3.1-8B at astro-orbiter:8002)
    # Source: 1Password item "openviking", field "vlm-api-key"
    # Phase 0 recommendation: placeholder token for local endpoint
    - secretKey: OPENVIKING_VLM_API_KEY
      remoteRef:
        key: openviking
        property: vlm-api-key